<!DOCTYPE html>
<html lang="zh-CN">





<head>
  <meta charset="UTF-8">
  <link rel="apple-touch-icon" sizes="76x76" href="/img/apple-touch-icon.png">
  <link rel="icon" type="image/png" href="/img/favicon.png">
  <meta name="viewport"
        content="width=device-width, initial-scale=1.0, maximum-scale=1.0, user-scalable=no, shrink-to-fit=no">
  <meta http-equiv="x-ua-compatible" content="ie=edge">
  
  <meta name="description" content="安全行业从业者，主要方向PC逆向附带安卓和Linux逆向，时不时喜欢写点BUG代码">
  <meta name="author" content="Cray">
  <meta name="keywords" content="">
  <title>强网杯wp ~ 逆向安全博客</title>

  <link rel="stylesheet" href="https://cdn.staticfile.org/font-awesome/5.12.1/css/all.min.css"  >
<link rel="stylesheet" href="https://cdn.staticfile.org/twitter-bootstrap/4.4.1/css/bootstrap.min.css"  >
<link rel="stylesheet" href="https://cdn.staticfile.org/mdbootstrap/4.13.0/css/mdb.min.css"  >
<link rel="stylesheet" href="https://cdn.staticfile.org/github-markdown-css/3.0.1/github-markdown.min.css"  >

<link rel="stylesheet" href="//at.alicdn.com/t/font_1067060_qzomjdt8bmp.css">



  <link rel="stylesheet" href="/lib/prettify/tomorrow.min.css"  >

<link rel="stylesheet" href="/css/main.css"  >


  <link rel="stylesheet" href="https://cdn.staticfile.org/fancybox/3.5.7/jquery.fancybox.min.css"  >


<meta name="generator" content="Hexo 5.2.0"></head>


<body>
  <header style="height: 70vh;">
    <nav id="navbar" class="navbar fixed-top  navbar-expand-lg navbar-dark scrolling-navbar">
  <div class="container">


    <button id="navbar-toggler-btn" class="navbar-toggler" type="button" data-toggle="collapse"
            data-target="#navbarSupportedContent"
            aria-controls="navbarSupportedContent" aria-expanded="false" aria-label="Toggle navigation">
      <div class="animated-icon"><span></span><span></span><span></span></div>
    </button>

    <!-- Collapsible content -->
    <div class="collapse navbar-collapse" id="navbarSupportedContent">
      <ul class="navbar-nav ml-auto text-center">
        
          
          
          
          
          <li class="nav-item">
            <a class="nav-link" href="/">首页</a>
          </li>
        
          
          
          
          
          <li class="nav-item">
            <a class="nav-link" href="/archives/">归档</a>
          </li>
        
          
          
          
          
          <li class="nav-item">
            <a class="nav-link" href="/tags/">标签</a>
          </li>
        
          
          
          
          
          <li class="nav-item">
            <a class="nav-link" href="/links/">友链</a>
          </li>
        
        
          <li class="nav-item" id="search-btn">
            <a class="nav-link" data-toggle="modal" data-target="#modalSearch">&nbsp;&nbsp;<i
                class="iconfont icon-search"></i>&nbsp;&nbsp;</a>
          </li>
        
      </ul>
    </div>
  </div>
</nav>

    <div class="view intro-2" id="background" false
      style="background: url('https://gitee.com/cve/BlogImg/raw/master/typora/image-20200822233144139.png') no-repeat center center;
      background-size: cover;">
    
        <div class="full-bg-img">
        <div class="mask rgba-black-light flex-center">
          <div class="container text-center white-text fadeInUp">
            <span class="h2" id="subtitle">
              
                强网杯wp
              
            </span>

            
              <br>
              

              <p>
                
                  
                  &nbsp;<i class="far fa-chart-bar"></i>
                  <span class="post-count">
                    2.1k 字
                  </span>&nbsp;
                

                
                  
                  &nbsp;<i class="far fa-clock"></i>
                  <span class="post-count">
                      11 分钟
                  </span>&nbsp;
                

                
                  <!-- 不蒜子统计文章PV -->
                  
                  &nbsp;<i class="far fa-eye" aria-hidden="true"></i>&nbsp;
                  <span id="busuanzi_container_page_pv">
                    <span id="busuanzi_value_page_pv"></span> 次
                  </span>&nbsp;
                
              </p>
            
          </div>

          
        </div>
      </div>
    </div>
  </header>

  <main>
    
      

<div class="container-fluid">
  <div class="row">
    <div class="d-none d-lg-block col-lg-2"></div>
    <div class="col-lg-8 nopadding-md">
      <div class="py-5 z-depth-3" id="board">
        <div class="post-content mx-auto" id="post">
          <div class="markdown-body">
            <h2 id="xx-warmup-obf"><a href="#xx-warmup-obf" class="headerlink" title="xx_warmup_obf"></a>xx_warmup_obf</h2><p><img src="https://gitee.com/cve/BlogImg/raw/master/typora/image-20200822233144139.png" srcset="/img/loading.gif"></p>
<p>跑一边感觉没什么东西，题目名给人感觉是有混淆</p>
<p>动态调试的时候发现有构造好的int 3 中断，说明程序肯定自己注册了异常处理函数（开始一直没找到）</p>
<p>我做的时候是看操作码，一般没见过的都是混淆指令，比如下面这类，说明不会跳转到这个代码块</p>
<p><img src="https://gitee.com/cve/BlogImg/raw/master/typora/image-20200822233810568.png" srcset="/img/loading.gif" alt="image-20200822233810568"></p>
<p>根据字符串可以找到有调用，但是函数均有混淆，动态调调前两个知道都是写花指令</p>
<p><img src="https://gitee.com/cve/BlogImg/raw/master/typora/image-20200822233524713.png" srcset="/img/loading.gif" alt="image-20200822233524713"></p>
<p>随意输入flag返回错误是 bad passcode，说明可能还有其他验证，不是直接就去比较flag是否正确</p>
<p><img src="https://gitee.com/cve/BlogImg/raw/master/typora/image-20200822234853719.png" srcset="/img/loading.gif" alt="image-20200822234853719"></p>
<p>根据这个提示可以往上层找，找到<code>sub_409142</code></p>
<p><img src="https://gitee.com/cve/BlogImg/raw/master/typora/image-20200822235351919.png" srcset="/img/loading.gif" alt="image-20200822235351919"></p>
<p>然后随意构造长度0x1C的字符串去测试，如下提示</p>
<p><img src="https://gitee.com/cve/BlogImg/raw/master/typora/image-20200822235808039.png" srcset="/img/loading.gif" alt="image-20200822235808039"></p>
<p>根据正确输出和错误输出的调用顺序往上找，直到<code>sub_4095DD</code>代码块处</p>
<p><img src="https://gitee.com/cve/BlogImg/raw/master/typora/image-20200823000031892.png" srcset="/img/loading.gif" alt="image-20200823000031892"></p>
<p>就能找到这个判断flag的代码块是<code>sub_402968</code></p>
<p>这个代码块中前几个都是混淆块，不用管</p>
<p>直到<code>sub_402D05</code>才有用，开始对比flag</p>
<p><img src="https://gitee.com/cve/BlogImg/raw/master/typora/image-20200823000630079.png" srcset="/img/loading.gif" alt="image-20200823000630079"></p>
<p>jz过去就是判断第二位</p>
<p><img src="https://gitee.com/cve/BlogImg/raw/master/typora/image-20200823000734430.png" srcset="/img/loading.gif" alt="image-20200823000734430"></p>
<p>后面依次类推,直到找到<code>loc_408470</code></p>
<p><img src="https://gitee.com/cve/BlogImg/raw/master/typora/image-20200823000904917.png" srcset="/img/loading.gif" alt="image-20200823000904917"></p>
<p>处理一下函数，可以F5成这样，后面就不一一截图了</p>
<p><img src="https://gitee.com/cve/BlogImg/raw/master/typora/image-20200823001143624.png" srcset="/img/loading.gif" alt="image-20200823001143624"></p>
<p>看到这个我的z3已经迫不及待了呢</p>
<pre><code class="python">from z3 import *
s =Solver()

for i in  range (0,33):
  flag[i] = BitVec(&#39;f%d&#39; % i,8)
  s.add(flag[i]&gt;=32,flag[i] &lt;=126)


s.add( 0x5D75 *flag0 == 2440350 )
s.add( 0x44B38 *flag[1] - 7037 *flag0 == 0x1C4C7D2 )
s.add( 174826 *flag0 - 0x3E544 *flag[2] - 0x453B5 *flag[1] == 0xFDC2EA1C )
s.add( 259881 *flag[2]-98445 *flag[1]- 276718 *flag0+4524 *flag[3] == -13182867 )
s.add( 285576 *flag[2]-274569 *flag[3]+94721 *flag0- 228216 *flag[4]- 60353 *flag[1] == 0xFE7ACBBB )
s.add( 260927 *flag[3]-5496 *flag[1]-294195 *flag[4]+264844 *flag[2]+125853 *flag[5]- 153661 *flag0 == 0xC78321 )
s.add( 17630 *flag0-258397 *flag[3]-244952 *flag[1]-244086 *flag[2]-130259 *flag[5]- 190371 *flag[6]- 109961 *flag[4] == -111027477 )
s.add( 117817 *flag[5]+268397 *flag[7]-198175 *flag[1]+18513 *flag[2]+218992 *flag[6]-6727 *flag[3]+228408 *flag0+224658 *flag[4] == 78775012 )
s.add( -288418 *flag[3]-218493 *flag[7]-236774 *flag0+77982 *flag[2]+190784 *flag[4]-84462 *flag[1]+92684 *flag[8]+52068 *flag[5]- 243023 *flag[6] == -52520267 )
s.add( -196269 *flag[8]-64473 *flag[7]-142792 *flag[5]+171321 *flag[4]-39259 *flag[9]-269632 *flag[2]+229049 *flag[6]+96631 *flag[3]- 280754 *flag[1]- 168397 *flag0 == -70797046 )
s.add( -235026 *flag[4]+162669 *flag[8]-256202 *flag[1]-32946 *flag[9]-25900 *flag[2]+195039 *flag[10]+182157 *flag[3]+292706 *flag0-93524 *flag[5]+121516 *flag[6]+165207 *flag[7] == 28263339 )
s.add( -131770 *flag[6]-92964 *flag[9]-111160 *flag[8]-258188 *flag[7]+133728 *flag[1]-272650 *flag[5]-4940 *flag[10]+272791 *flag[3]+80519 *flag[2]-165434 *flag[11]+50166 *flag0+148713 *flag[4] == -22025185 )
s.add( -262820 *flag[4]+9710 *flag[10]+71182 *flag[12]-184125 *flag[1]-100280 *flag[6]+62018 *flag[11]+141532 *flag[9]-138253 *flag[8]+20489 *flag0-214348 *flag[2]+162962 *flag[3]- 93199 *flag[7]+147171 *flag[5] == -31396844 )
s.add( -55254 *flag[8]+220404 *flag[12]-86956 *flag[10]-200702 *flag[5]-51437 *flag[1]+25739 *flag[6]+122945 *flag[3]+116256 *flag[7]+22859 *flag[4]-61880 *flag[9]-119275 *flag[2]-224754 *flag[13]- 75412 *flag0+59999 *flag[11] == -37063008 )
s.add( 111310 *flag0+198502 *flag[3]-189890 *flag[13]+278745 *flag[5]+157462 *flag[9]+135809 *flag[4]-2621 *flag[2]+67553 *flag[6]+144834 *flag[1]-88326 *flag[11]-228149 *flag[10]+233663 *flag[14]-249960 *flag[12]+300012 *flag[8]+91783 *flag[7] == 93457153 )
s.add( 15897 *flag0-11943 *flag[13]+194067 *flag[3]+125666 *flag[2]+104421 *flag[12]-181764 *flag[5]-233813 *flag[8]-235783 *flag[4]+230636 *flag[11]+148005 *flag[6]-48167 *flag[14]-163572 *flag[9]+54553 *flag[10]-129997 *flag[1]+114175 *flag[7]- 251681 *flag[15] == 0xFDD0E812 )
s.add( -90549 *flag[3]-228520 *flag[14]+34835 *flag[10]-203538 *flag[15]+272318 *flag[13]-68478 *flag[8]+22454 *flag[9]+74128 *flag[12]+70051 *flag[6]-289940 *flag[7]-52501 *flag[5]-1254 *flag[4]+154844 *flag[11]+254969 *flag[2]-39495 *flag[1]+277429 *flag[16]- 132752 *flag0 == -6628237 )
s.add( 128092 *flag[11]-5873 *flag[17]-144172 *flag[3]-148216 *flag[13]+189050 *flag[2]+66107 *flag[5]+237987 *flag0-53271 *flag[9]-86968 *flag[12]-94616 *flag[10]-247882 *flag[8]-5107 *flag[1]+55085 *flag[15]+10792 *flag[14]-112241 *flag[4]-36680 *flag[16]- 210718 *flag[7]- 249539 *flag[6] == -53084017 )
v13 = -186088 *flag[2]+ 19517 *flag[13]+ -65515 *flag[5]+ 195447 *flag[1]+ 145470 *flag[14]+ 58825 *flag[16]+ 272227 *flag[15]+ -155443 *flag[8]+ 100397 *flag[3]+ -238861 *flag[18]+ 84628 *flag[7]+ 1337 *flag[17]+ 156976 *flag[12]+ -74209 *flag[4]+ 175077 *flag[11]+ 134548 *flag0+ -280672 *flag[6]+ 12264 *flag[10];
s.add( v13 + 56937 *flag[9] == 60764977 )
v14 = -283834 *flag[9]+ 159144 *flag[13]+ -199631 *flag0+ 54404 *flag[16]+ -190345 *flag[8]+ 176103 *flag[3]+ 137206 *flag[17]+ -170051 *flag[6]+ 281718 *flag[11]+ 137214 *flag[14]+ -104395 *flag[19]+ -122090 *flag[4]+ 162065 *flag[15]+ -36580 *flag[18]+ 245858 *flag[12]+ -18520 *flag[10]+ -138274 *flag[1]+ 139185 *flag[2];
s.add( -58873 *flag[7] + v14 - 197535 *flag[5] == 4912728 )
v15 = 74470 *flag[8]+ -72984 *flag[11]+ -162393 *flag[20]+ 150036 *flag[15]+ 127913 *flag[19]+ 181147 *flag[16]+ 27751 *flag[6]+ -239133 *flag[1]+ -28337 *flag[17]+ 108149 *flag0+ 148338 *flag[2]+ 38137 *flag[18]+ -199427 *flag[14]+ -97284 *flag[4]+ -39775 *flag[3]+ -109205 *flag[10]+ 270604 *flag[5]- 193384 *flag[12];
s.add( 293345 *flag[9] + 63329 *flag[13] + v15 + 168963 *flag[7] == 45577809 )
v16 = -188979 *flag[8]+ -220539 *flag[16]+ 246135 *flag[2]+ -174651 *flag[14]+ 179514 *flag[4]+ 153071 *flag[15]+ -207716 *flag[21]+ 64641 *flag[7]+ 293781 *flag[12]+ 263208 *flag[10]+ 44675 *flag[1]+ 131692 *flag[3]+ 109605 *flag[11]+ 293201 *flag[5]+ -98937 *flag[9]+ 60492 *flag[20]+ -273571 *flag[13]- 38942 *flag0;
s.add( 45637 *flag[6]+111858 *flag[17]+244009 *flag[19]+v16- 285946 *flag[18] == 77539017 )
v17 = -86224 *flag[20]+ 92896 *flag[22]+ 295735 *flag[15]+ -58530 *flag0+ -197632 *flag[13]+ -21957 *flag[17]+ -43684 *flag[6]+ -141434 *flag[10]+ -194890 *flag[1]+ -148390 *flag[21]+ 105293 *flag[14]+ 76213 *flag[3]+ 9791 *flag[12]+ -258754 *flag[8]+ 59119 *flag[16]+ 255675 *flag[2]+ -130852 *flag[7]- 71444 *flag[5];
s.add( -160726 *flag[9]+234971 *flag[18]+32897 *flag[4]-206184 *flag[11]+v17+127285 *flag[19] == -38197685 )
v18 = -236806 *flag[17]+ 268813 *flag[3]+ 191822 *flag[23]+ -40848 *flag[6]+ 103466 *flag[7]+ -211930 *flag[5]+ -180522 *flag[19]+ -188959 *flag[15]+ -238839 *flag[21]+ 281705 *flag[11]+ 175825 *flag[16]+ -44618 *flag[12]+ 196370 *flag0+ 89330 *flag[22]+ -133696 *flag[8]+ -60213 *flag[2]+ 191404 *flag[18]- 291063 *flag[9];
s.add( 205675 *flag[20]+197685 *flag[1]+144870 *flag[4]+120347 *flag[10]+202621 *flag[14]+v18+13902 *flag[13] == 67763764 )
v19 = 115716 *flag[22]+ 7838 *flag[16]+ -173902 *flag[14]+ 115189 *flag[9]+ 234832 *flag[7]+ -54321 *flag[5]+ -268221 *flag[20]+ -210563 *flag[18]+ -161113 *flag[13]+ -199130 *flag[23]+ -94067 *flag[24]+ 9601 *flag[11]+ -8509 *flag[12]+ 14439 *flag[2]+ -243227 *flag[19]+ 37665 *flag[17]+ 91076 *flag[6]- 85246 *flag0;
s.add( 69341 *flag[15]-19740 *flag[21]+62004 *flag[10]+29334 *flag[8]-78459 *flag[1]-261617 *flag[3]+v19+39558 *flag[4] == -98330271 )
v20 = -78437 *flag[20]+ -212633 *flag[16]+ 180400 *flag[5]+ -81477 *flag[12]+ 232645 *flag0+ -65268 *flag[4]+ 263000 *flag[6]+ 247654 *flag[25]+ -242059 *flag[17]+ -35931 *flag[9]+ -271816 *flag[21]+ 10191 *flag[13]+ 41768 *flag[23]+ 92844 *flag[7]+ -73366 *flag[14]+ -124307 *flag[10]+ 197710 *flag[18]+ 226192 *flag[15];
s.add( 38468 *flag[19]-75568 *flag[2]+169299 *flag[22]-252915 *flag[3]+32044 *flag[24]-260264 *flag[8]-111200 *flag[1]+v20+3788 *flag[11] == -13464859 )
v21 = -6866 *flag[25]+ 215574 *flag[22]+ 231326 *flag[6]+ 77915 *flag[2]+ 186585 *flag[3]+ 219151 *flag[4]+ 271210 *flag[13]+ -78913 *flag[20]+ 83918 *flag[8]+ -153409 *flag[18]+ -84952 *flag[7]+ -121854 *flag0+ -253617 *flag[26]+ -213665 *flag[19]+ -293146 *flag[17]+ -166693 *flag[16]+ -206964 *flag[1]- 155664 *flag[10];
s.add( -23897 *flag[9]-188087 *flag[24]-254282 *flag[15]-102361 *flag[23]-15606 *flag[14]-74795 *flag[21]+116581 *flag[12]+77693 *flag[5]+v21+180598 *flag[11] == -55504393 )
v22 = -120743 *flag[10]+ 77375 *flag[5]+ -164339 *flag[3]+ 167370 *flag[25]+ -225830 *flag[4]+ -136952 *flag[2]+ -14347 *flag[8]+ 6966 *flag[26]+ 88628 *flag[18]+ 138998 *flag[22]+ 147747 *flag[19]+ -106792 *flag[6]+ -113009 *flag[20]+ 98136 *flag[15]+ 231264 *flag[24]+ -109447 *flag[17]+ 258890 *flag[1]+ 167885 *flag[16];
s.add( 264405 *flag[11]+135302 *flag[12]+278196 *flag[9]-132906 *flag[23]+138308 *flag[7]+40423 *flag[21]+157781 *flag0-38949 *flag[27]-143324 *flag[14]+v22+246315 *flag[13] == 133068723 )

print(s.check())
m = s.model()
print (sorted ([(d, m[d]) for d in m], key = lambda x: str(x[0])))


#按顺序处理下就行
flag=[ 102, 108, 97, 103, 123, 103, 48, 95, 70, 117, 99, 107, 95, 120, 120, 95, 53, 101, 103, 109, 51, 110, 116, 95, 48, 98, 102, 125, 64, 32, 64, 32, 32]
for i in flag:
   print(chr(i),end=&quot;&quot;)
</code></pre>
<h3 id="总结"><a href="#总结" class="headerlink" title="总结"></a>总结</h3><p>再看其实就是接管异常，所以调试没反应，是因为将处理权交给了当前调试器，而我们不知道怎么处理数据，所以无法执行，这也是本题的一个关键地方。</p>
<p><img src="https://gitee.com/cve/BlogImg/raw/master/typora/image-20200823010420781.png" srcset="/img/loading.gif" alt="image-20200823010420781"></p>
<p><img src="https://gitee.com/cve/BlogImg/raw/master/typora/image-20200823010217350.png" srcset="/img/loading.gif" alt="image-20200823010217350"></p>
<p>如果你非常想调试，但是又确实看不懂handle里面是怎么处理的，可以试试下面的方法</p>
<p>把你要调试的地方的指令改为 0xEBFE 也就是jmp自身，等于一个sleep</p>
<p>比如我去看对比flag的时候做了如下修，</p>
<p><img src="https://gitee.com/cve/BlogImg/raw/master/typora/image-20200823011518187.png" srcset="/img/loading.gif" alt="image-20200823011518187"></p>
<p>然后去attach，就可以开开心心调试了</p>
<p><img src="https://gitee.com/cve/BlogImg/raw/master/typora/image-20200823011321623.png" srcset="/img/loading.gif" alt="image-20200823011321623"></p>
<h3 id="更推荐的做法"><a href="#更推荐的做法" class="headerlink" title="更推荐的做法"></a>更推荐的做法</h3><p>不用z3处理数据，直接约束执行流程，快速且不怕出错。</p>
<pre><code class="python">import angr

START_ADDR = 0x402D10 # first part of program that does computation
AVOID_ADDR =[0x408469,0x402D2F,0x402F96,0x4032C5,0x4034B6,0x4035CF,0x403728,0x4039D4,0x403B27,0x403CB9,0x403E34,0x40418F,0x40459C,0x4048FE,0x404C6D ,0x405051 ,0x405286,0x405594,0x4057EF,0x0405B96,0x406057 ,0x406537 ,0x406931,0x406DA9,0x407069,0x407606 ,0x040790B ,0x407D8F,0x4081B4] # address of function that prints wrong
FIND_ADDR = [0x408470,]# address of function that prints correct
INPUT_ADDR = 0x200000 #tmp address to save flag
LENFLAG = 0x1C

p = angr.Project(&#39;xx_warmup_obf&#39;)
state = p.factory.blank_state(addr=START_ADDR, add_options=&#123;angr.options.LAZY_SOLVES&#125;)
flag_chars = [state.solver.BVS(&#39;flag_%d&#39; % i, 8) for i in range(LENFLAG)]
for flag_chr in flag_chars:
    state.add_constraints(state.solver.And(flag_chr &gt;= ord(&#39; &#39;),flag_chr &lt;= ord(&#39;~&#39;)))

for i in range(LENFLAG):
    state.memory.store(INPUT_ADDR+i,flag_chars[i])
state.regs.rax = INPUT_ADDR
state.regs.rbp = state.regs.rsp

#state.
ex = p.factory.simulation_manager(state)

ex.explore(find=FIND_ADDR, avoid=AVOID_ADDR)
found = ex.found[0] 
flag = found.solver.eval(state.memory.load(INPUT_ADDR,LENFLAG), cast_to=bytes)
print(flag)</code></pre>

            <hr>
          </div>
          <br>
          <div>
            <p>
            
            
              <span>
                <i class="iconfont icon-tag"></i>
                
                  <a class="hover-with-bg" href="/tags/CTF/">CTF</a>
                
              </span>
            
            </p>
            
              <p class="note note-warning">本博客所有文章除特别声明外，均采用 <a target="_blank" href="https://zh.wikipedia.org/wiki/Wikipedia:CC_BY-SA_3.0%E5%8D%8F%E8%AE%AE%E6%96%87%E6%9C%AC" rel="nofollow noopener noopener">CC BY-SA 3.0协议</a> 。转载请注明出处！</p>
            
          </div>
        </div>
      </div>
    </div>
    
      <div class="d-none d-lg-block col-lg-2 toc-container">
        <div id="toc">
  <p class="h5"><i class="far fa-list-alt"></i>&nbsp;目录</p>
  <div id="tocbot"></div>
</div>
      </div>
    
  </div>
</div>

<!-- custom -->


<!-- Comments -->
<div class="col-lg-7 mx-auto nopadding-md">
  <div class="container comments mx-auto" id="comments">
    
      <br><br>
      
      
  <div class="disqus" style="width:100%">
    <div id="disqus_thread"></div>
    <script>
      var disqus_config = function () {
        this.page.url = 'http://cve.gitee.io/cve/2020/08/24/wp/';
        this.page.identifier = '/2020/08/24/wp/';
      };
      var oldLoad = window.onload;
      window.onload = function () {
        var d = document, s = d.createElement('script');
        s.type = 'text/javascript';
        s.src = '//' + 'crayon-1' + '.disqus.com/embed.js';
        s.setAttribute('data-timestamp', +new Date());
        (d.head || d.body).appendChild(s);
      };
    </script>
    <noscript>Please enable JavaScript to view the <a target="_blank" href="https://disqus.com/?ref_noscript" rel="nofollow noopener noopener">comments
        powered by Disqus.</a></noscript>
  </div>


    
  </div>
</div>

    
  </main>

  
    <a class="z-depth-1" id="scroll-top-button" href="#" role="button">
      <i class="fa fa-chevron-up scroll-top-arrow" aria-hidden="true"></i>
    </a>
  

  
    <div class="modal fade" id="modalSearch" tabindex="-1" role="dialog" aria-labelledby="ModalLabel"
     aria-hidden="true">
  <div class="modal-dialog modal-dialog-scrollable modal-lg" role="document">
    <div class="modal-content">
      <div class="modal-header text-center">
        <h4 class="modal-title w-100 font-weight-bold">搜索</h4>
        <button type="button" id="local-search-close" class="close" data-dismiss="modal" aria-label="Close">
          <span aria-hidden="true">&times;</span>
        </button>
      </div>
      <div class="modal-body mx-3">
        <div class="md-form mb-5">
          <input type="text" id="local-search-input" class="form-control validate">
          <label data-error="x" data-success="v"
                 for="local-search-input">关键词</label>
        </div>
        <div class="list-group" id="local-search-result"></div>
      </div>
    </div>
  </div>
</div>
  

  <footer class="mt-5">
  <div class="text-center py-3">
    <a href="https://hexo.io" target="_blank" rel="nofollow noopener"><b>Hexo</b></a>
    <i class="iconfont icon-love"></i>
    <a href="https://github.com/fluid-dev/hexo-theme-fluid" target="_blank" rel="nofollow noopener"> <b>Fluid</b></a>
    <br>

    
  
    <!-- 不蒜子统计PV -->
    
    &nbsp;<span id="busuanzi_container_site_pv"></span>总访问量 
          <span id="busuanzi_value_site_pv"></span> 次&nbsp;
  
  
    <!-- 不蒜子统计UV -->
    
    &nbsp;<span id="busuanzi_container_site_uv"></span>总访客数 
            <span id="busuanzi_value_site_uv"></span> 人&nbsp;
  
  <br>



    


    <!-- cnzz Analytics icon -->
    

  </div>
</footer>

<!-- SCRIPTS -->
<script src="https://cdn.staticfile.org/jquery/3.4.1/jquery.min.js" ></script>
<script src="https://cdn.staticfile.org/popper.js/1.16.1/umd/popper.min.js" ></script>
<script src="https://cdn.staticfile.org/twitter-bootstrap/4.4.1/js/bootstrap.min.js" ></script>
<script src="https://cdn.staticfile.org/mdbootstrap/4.13.0/js/mdb.min.js" ></script>
<script src="/js/main.js" ></script>


  <script src="/js/lazyload.js" ></script>



  
  <script src="https://cdn.staticfile.org/tocbot/4.10.0/tocbot.min.js" ></script>
  <script>
    $(document).ready(function () {
      var navHeight = $('#navbar').height();
      var toc = $('#toc');
      var main = $('main');
      var tocT = navHeight + (toc.offset().top - main.offset().top);
      var tocLimMin = main.offset().top - navHeight;
      var tocLimMax = $('#comments').offset().top - navHeight;
      $(window).scroll(function () {
        var scroH = document.body.scrollTop + document.documentElement.scrollTop;
        if (tocLimMin <= scroH && scroH <= tocLimMax) {
          toc.css({
            'display': 'block',
            'position': 'fixed',
            'top': tocT,
          });
        } else if (scroH <= tocLimMin) {
          toc.css({
            'position': '',
            'top': '',
          });
        } else if (scroH > tocLimMax) {
          toc.css('display', 'none');
        }
      });
      tocbot.init({
        tocSelector: '#tocbot',
        contentSelector: '.post-content',
        headingSelector: 'h1,h2,h3,h4,h5,h6',
        linkClass: 'tocbot-link',
        activeLinkClass: 'tocbot-active-link',
        listClass: 'tocbot-list',
        isCollapsedClass: 'tocbot-is-collapsed',
        collapsibleClass: 'tocbot-is-collapsible',
        scrollSmooth: true,
      });
      if ($('.toc-list-item').length > 0) {
        $('#toc > p').css('visibility', 'visible');
      }
    });
  </script>







  <script async src="//busuanzi.ibruce.info/busuanzi/2.3/busuanzi.pure.mini.js" ></script>


<!-- Plugins -->



  <script src="https://cdn.staticfile.org/prettify/188.0.0/prettify.min.js" ></script>
  <script>
    $(document).ready(function () {
      $('pre').addClass('prettyprint  linenums');
      prettyPrint();
    })
  </script>





  <script src="https://cdn.staticfile.org/anchor-js/4.2.2/anchor.min.js" ></script>
  <script>
    anchors.options = {
      placement: "right",
      visible: "hover",
      
    };
    var el = "h1,h2,h3,h4,h5,h6".split(",");
    var res = [];
    for (item of el) {
      res.push(".markdown-body > " + item)
    }
    anchors.add(res.join(", "))
  </script>



  <script src="/js/local-search.js" ></script>
  <script>
    var path = "/local-search.xml";
    var inputArea = document.querySelector("#local-search-input");
    inputArea.onclick = function () {
      getSearchFile(path);
      this.onclick = null
    }
  </script>



  <script src="https://cdn.staticfile.org/fancybox/3.5.7/jquery.fancybox.min.js" ></script>
  <script>
    $("#post img:not(.no-zoom img, img[no-zoom])").each(
      function () {
        var element = document.createElement("a");
        $(element).attr("data-fancybox", "images");
        $(element).attr("href", $(this).attr("src"));
        $(this).wrap(element);
      }
    );
  </script>












</body>
</html>
